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(57) A monitoring system for detecting failures, or 
impending failures, in subsystems of a fly-by-wire pri- 
mary flight control system of an aircraft. The system 
monitors a critical variable of at least two controllers 
(102,112) acting in concert, in real time. Differences 
between the critical variables are calculated and, after 
filtering to remove insignificant variations, is estimated 



based on significant detected variations. Depending 
upon the relative severity of the estimated fatigue dam- 
age, the aircraft's primary flight control computer is pro- 
grammed to shut down the malfunctioning subsystem, 
display a message indicating need for repair, or take 
other appropriate action. 
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Description 

Field of the Invention 

The invention relates to the detection of failures and s 
potential failures in primary flight control systems. More 
particularly the invention provides systems for detecting 
and predicting failures in fly-by-wire flight systems 
where failure modes of certain subsystems are not 
readily predictable. 

Background of the Invention 

The most typical flight control system used in cur- 
rent aircraft relies upon direct mechanical linkages 
between the pilot's control devices and aircraft flight 
control surfaces. Thus, when a pilot manipulates con- 
trols such as the rudder pedals, various levers, and the 
control column, mechanical linkages transmit move- 
ment of the controls to aircraft flight control surfaces, 
such as rudders, ailerons, flaperons, and elevators, to 
move these surfaces appropriately in response. This 
system provides several advantages. Not only is the 
system relatively simple with predictable failure modes 
and effects, but it provides direct control of the aircraft 
control surfaces. The system is also reliable, since air- 
craft manufacturers and operators have had long expe- 
rience with mechanical flight control systems. 

There has now been developed an aircraft flight 
control system that is not reliant on direct mechanical 
linkages but uses electronic controllers that receive and 
transmit electrical signals to control devices, such as 
hydraulic actuators, that in turn control the movement of 
aircraft flight control surfaces. This type of system, 
known as a "fly-by-wire" system, provides significant 
advantages over the direct mechanically linked flight 
systems. The use of highly reliable electronic signals 
generated in response to pilot manipulation of flight 
deck controls or autopilot commands, instead of 
mechanical linkages, provides the possibility of 
improved overall system reliability and performance. 
Also, the system is easier to maintain. 

The fly-by-wire aircraft control system, however, 
imposes new system monitoring requirements. In gen- 
eral, when a mode of failure of a subsystem is predicta- 
ble, then a monitor can be developed to sense and 
signal the failure of the subsystem, when it fails accord- 
ing to the predicted mode. There are, however, certain 
subsystems for which the failure modes are neither 
readily predictable nor are symptoms of failure easily 
detectable. Also, in certain circumstances, monitoring 
the effects of a failure on a flight control surface may 
require a very sensitive sensing device, which may lead 
to false warnings (i.e., an indication of failure when there 
is none) sometimes necessitating an unnecessary shut- 
down of the subsystem. For example, if an elevator 
were monitored by sensing motion of the elevator sur- 
face, then setting the sensor to detect only wide varia- 
tions in movement may not permit detection of smaller 



movements that may nevertheless result from an actua- 
tor malfunction. On the other hand, if the sensor is set 
for high sensitivity to detect small movements, then the 
sensor may falsely report failure, when the small move- 
ments detected are not symptomatic of a failure, leading 
to unnecessary system shutdown. Such shutdowns are 
not only expensive, in terms of unnecessary aircraft 
downtime for repairs, but may also somewhat decrease 
fight safety margin by decreasing the redundancy of 
control systems of the aircraft. 

There exists a need for a system for detecting fail- 
ures in subsystems of fly-by-wire primary flight control 
systems, especially those subsystems that are not 
readily monitored because all their failure modes are 
not readily predictable and may not be easily detected 
by conventional monitors. Further, the monitoring sys- 
tem should desirably be readily integrated with existing 
equipment of the primary flight control system and the 
aircraft's primary flight control computer and should not 
be susceptible to a high frequency of false positive fail- 
ure reports. 

Summary of the Invention 

The invention provides a monitoring system for 
detecting failures, or impending failures, in subsystems 
of a fly-by-wire primary flight control system of an air- 
craft. The monitoring system is integrated with the pri- 
mary flight computer of the aircraft, is broadly applicable 
to a range of subsystems, and is particularly suited to 
those subsystems that are not susceptible to ready 
analysis for identifying modes of failure. 

The system requires sensors to intermittently mon- 
itor, at preselected sampling intervals, an identified crit- 
ical parameter on at least two cooperating components 
of a subsystem, such as the differential pressures, or 
load, of two hydraulic actuators working in concert. The 
system further includes filtering of the monitored param- 
eters to screen out "noise" or noncritical variations 
between these parameters and to identify critical vari- 
ances from expected performance. These critical vari- 
ances are determined by first selecting a predetermined 
degree of variance from the expected operation that will 
be filtered out as an "acceptable" variance. Any vari- 
ance in excess of the acceptable variance indicates a 
local maximum or minimum variation and is measured 
as a "critical" variance, according to the invention The 
system of the invention also takes into account the fre- 
quency of occurrence of critical variances. Based on the 
magnitude and frequency of critical variances, the sys- 
tem calculates the rate of change of structural fatigue 
damage. When the calculated rate of change exceeds a 
predetermined level, the primary fight control computer 
takes appropriate action. 

According to the invention, several monitor trip lev- 
els may be used to determine appropriate action based 
upon severity of the calculated fatigue failure. For exam- 
ple, if within a time period dt^, the calculated fatigue 
damage changed by fd^, then action a^ may be indi- 
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cated. If within a different time period, dt2, the damage 
calculated changed by fd2, then action a2 would be indi- 
cated, and the like. Generally, the time periods cA„ may 
vary in magnitude from about 10 seconds to about 100 
seconds, and up to the duration of a complete fight. The 5 
actions indicated, an, are dependent upon the severity 
of the calculated failure. Thus, if the fatigue damage 
estimated is of a very serious nature, exceeding a pre- 
determined magnitude, the flight control computer shuts 
down the subsystem. If the estimated damage is not of 
a very serious nature and does not repeat within a pre- 
determined time period, the subsystem is not shut 
down, but a signal from the primary flight computer indi- 
cates that technical staff should Inspect for damage, 
upon aircraft landing, and that any damage should be 
repaired before resuming flights. In yet another option, If 
the fatigue damage estimation Is very low, then the pri- 
mary flight computer may allow continued flights for a 
predetermined period of time or number of flights. 

The monitoring system of the invention also 
Includes safeguards to prevent unnecessary activation 
of the system due to errant readings. The system Is 
designed to ignore readings when the aircraft operates 
beyond a certain normal range of parameters, such as 
may be encountered during dynamic situations of over- 
or underspeed; or when the aircraft Is steeply banked, 
such as during avoidance maneuver or during an upset; 
or when the aircraft Is within a certain distance of the 
ground during takeoff These parameters are part of the 
flight envelope of the aircraft that Is programmed Into 
primary flight computer's control laws. Thus, when 
envelope protection control law Is activated, the step of 
the monitoring system that shuts down a subsystem 
determined to be In failure Is Inhibited. These safe- 
guards are designed to prevent Inappropriate shutdown 
of the subsystem that could create a potentially unsafe 
condition. 

Brief Description of the Drawings 

The foregoing aspects and many of the attendant 
advantages of this invention will become more readily 
appreciated as the same becomes better understood by 
reference to the following detailed description, when 
taken In conjunction with the accompanying drawings, 
wherein: 

FIGURE 1 1s a schematic diagram showing hydrau- 
lic actuators used to control the orientation of an 
aircraft flight control surface; 
FIGURE 2 is a schematic block diagram showing 
the integration of the monitoring system of the 
invention with the primary flight computer of the air- 
craft; 

FIGURE 3 is an exemplary graphical depiction of 
signals received from a control device monitored by 
the system of the Invention; and 



FIGURE 4 is a logic flowchart showing steps used 
in accordance with the system of the invention to 
detect failure or impending failure in a subsystem. 

Detailed Description of the Preferred Embodiment 

While the monitoring systems of the invention are 
applicable to a wide range of subsystems of a primary 
aircraft flight control system, an exemplary subsystem is 
schematically illustrated in FIGURE 1. In this subsys- 
tem, two hydraulic actuators 10 act in concert to control 
the position of an aircraft flight control surface 50. Each 
of the hydraulic actuators 10 has a cylindrical sleeve 16 
filled with hydraulic fluid. Cylindrical pistons 18, each 
having a central axlally mounted rod 12 extending there- 
from, reciprocate within sleeve 16. Pressed fluid is 
ported to either side of the piston to move the piston, 
thereby positioning the flight control surface in response 
to pilot or autopilot commands. The difference in 
hydraulic pressure between the two sides of the piston, 
"the differential pressure," is proportional to the airload. 
This differential pressure is measured by pressure sen- 
sor 15. The ends 14 of rods 12 extend out of sleeve 16 
and are mechanically coupled to flight control surface 
50 so that rods 1 2 move In concert to command the sur- 
face Into a desired orientation. 

While the actual mechanical coupling of the rods 1 2 
with the aircraft flight control surface Is not Illustrated In 
FIGURE 1 , the structural stiffness of the coupling to the 
flight surface may be represented by a beam 52. Thus, 
for Instance, If either of actuators 10 falls, resulting In 
relative out of sync motion between rods 12, then differ- 
ent loads are applied to each end of beam 52. As a con- 
sequence, different mechanical loads are applied to the 
two actuators. If the failure causes these loads to oscil- 
late, fatigue damage will occur and beam 52, or another 
structural member, may fall due to fatigue. 

The monitoring system of the Invention may be bet- 
ter understood with reference to FIGURE 2, a sche- 
matic block diagram of an embodiment of the monitoring 
system. As a preliminary matter, the differential pres- 
sure across an actuator piston is represented by "DP", 
and the difference between the DP of one actuator and 
the other at any given point in time is represented by 
"DDP". for ease of description. Devices for controlling 
the orientation of flight control surfaces are generally 
electrically linked to control electronics. Thus, actuator 
100 is electrically linked to actuator control electronics 
102; and actuator 1 10, operating in concert with actua- 
tor 100, is in electrical communication with actuator con- 
trol electronics 112. Actuator control electronics 102 
and 112 periodically monitor the differential pressure 
(DP) across actuators 100 and 110, respectively, and 
transmit signals representative of the DPs to the pri- 
mary flight control computer (a digital signal processor) 
140. 

In the primary flight control computer, incoming sig- 
nals from the actuator control electronics 102 and 112 
are first analyzed to determine whether there is a critical 
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variance between the operation of actuator 100 and 
actuator 1 10 that would indicate that they are no longer 
acting in concert, but that one of the two actuators is out 
of synchronization with the other, or is malfunctioning in 
some other way to impose undue stress upon the flight 
control surface subsystem. This analysis commences in 
block 114, where signals are processed through two fil- 
ters. As a general matter, under nonfailure conditions, 
the value of DDP, the difference between DPi and DP2, 
will remain near zero. However, during failure condi- 
tions, the value of DDP will vary depending upon the 
magnitude and frequency of the failure. At low frequen- 
cies, typically less than 5 Hz, DP.| and DP2 will be equal 
in magnitude, but opposite in phase, thereby producing 
a large DDP signal. At higher frequencies, above 5 Hz, 
DPi and DP2 may differ in magnitude, and become in 
phase, due to the dynamics of the structure and the 
actuators. In the event that DP.| and DP2 become in 
phase, a DDP signal would not accurately represent the 
true magnitude of the failure or damage that is occur- 
ring. The monitor therefore also uses individual DP sig- 
nals to assess presence of a failure. Thus, in block 114, 
the difference between DP-i and DP2 is passed through 
a low-pass filter that attenuates the signal above a cer- 
tain predetermined cutoff frequency Since the monitor- 
ing system does not determine which of the control 
system components, such as the two actuators or their 
control electronics, is in failure, the input signal to the 
high-pass filter is periodically switched from DPi to DP2. 
This allows the system to recognize and take into 
account magnitudes of signals from each actuator, to 
calculate damage. While this will not pinpoint which 
component of the subsystem is in failure, it will ensure 
that large load variations do not go unmonitored. The 
high-pass filter attenuates oscillations in the DP signals 
at frequencies that may result from pilot commands, but 
allows higher frequencies to pass through to be used in 
the determination of a failure. Thus, the method of the 
invention sums the signals from the low-pass and high- 
pass filters to produce a summed signal that can more 
accurately identify a failure. This summed signal is 
transmitted to block 1 1 6. 

Block 1 1 6 includes a routine for the determination 
of local maxima and minima. The determination of 
these local maxima and minima is critically important 
because fatigue damage increases exponentially with 
the magnitude of load reversals. Therefore, it is impor- 
tant to differentiate between large load reversals and a 
series of several smaller reversals. The calculation 
sequence of block 116 is designed to disregard small 
load reversals, determine the large load reversals, and 
estimate fatigue damage for the large loads. 

The method of local maxima and minima detection 
of block 1 1 6 is best understood with reference to FIG- 
URES 3 and 4. FIGURE 3 is an exemplary graphical 
depiction of real-time differences between signals 
(DDP) calculated from signals (representing DP) that 
may be received from control devices, monitored by the 
system of the invention. FIGURE 4 is a logic flowchart 



showing the steps used in local maxima and minima 
detection. For ease of explanation, a predetermined 
acceptable variation of 800 psi will be used. Thus, if a 
variation between compared DPs is less than 800 psi, 

5 this is a noncritical difference. Referring to FIGURE 4, a 
first value of DDP is read in block 200. Block 202 com- 
pares a stored DDP (which is DDP^ax) with the newly 
read DDR If the new DDP is greater than the old DDP- 
max. then the new DDP is stored as DDP^ax- 1" block 

10 204, DDP is compared with DDP^ax- 800. If DDP^ax 
exceeds DDP by more than 800, then block 206 calcu- 
lates the fatigue damage based on DDP^g^ and DDP- 
min, previously determined. On the other hand, if 
DDP^ax is not n^ore than 800 greater than DDP, then a 

15 new DDP is read, bearing in mind that the system oper- 
ates in real time. After the calculation of damage in 
block 206, DDP is set equal to DDPmin- A new DDP is 
now read in block 210 and is compared with a previ- 
ously stored minimum value of DDP, DDP^jp. A new 

20 DDPmin is Selected from DDP and the previously stored 
DDP^in. In block 214, DDP^in is compared against 
DDR If DDPmin is less than DDP by more than 800 psi, 
then the system calculates damage in block 216 based 
on DDPmax and DDP^in- If not, then a new DDP is read 

25 in block 210. After damage calculation in block 216, 
DDP is set equal to DDP^ax and the calculation 
sequence looks back to block 200, where a new DDP is 
read in. 

The calculation of fatigue damage may be based on 

30 appropriate fatigue damage equations found in stand- 
ard engineering textbooks, such as Shigley & Mitchell, 
Mechanical Engineering Design, McGraw Hill Series in 
Mechanical Engineering, Fourth Edition. In general, 
fatigue damage is a function of the following parame- 

35 ters: material of construction of structure; geometry 
(length, width, cross-sectional area, etc.); stress con- 
centration (hole, thread, fillet, etc.); mean load (1/4 (max- 
imum load + minimum load)); and alternating load (V^ 
(maximum load - minimum load)). Fatigue damage from 

40 each cycle may be summed using Miner's rule, which is 
also set forth in standard engineering texts. 

Typically, load calculations are logarithmic in 
nature. However, to reduce the computation load for the 
primary flight computer those may be reduced to a third 

45 order polynomial using curve-fitting techniques. This 
method provides a sufficiently close correlation to the 
standard fatigue damage equations, while allowing a 
significant reduction in computational effort. 

Applying these steps to FIGURE 3, local maxima 

50 and minima may be determined at Im^, Im4, and Img. 
Thus, commencing with the assumption that Im^, at t^, 
identifies a local minimum, a new DDP is read as Im2 at 
time t2. According to the first loop of FIGURE 4, dis- 
cussed above, Im2 is stored as DDP^ax. since it is larger 

55 than any of the intervening values of DDP between t2 
and ti . At time ts, DDP has declined from Im2. However, 
since Ims is not more than 800 less than Im2, Im2 is not 
identified as a local maximum. By t4, DDP has 
increased to Im4. Consequently, Im4 is at this point 
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stored as DDP^^^. At ts, Irrig is more than 800 less than 
Im4. Thus, Im4 is identified as a local maximum and the 
routine calculates damage based on the maximum 
DDP, Im4, and the minimum DDR im^. The routine of 
FIGURE 4 now reverts to storing new DDR values as 5 
DDRmin and continues to read DDRs in real time. Thus, 
at te of FIGURE 3, DDR decreases to Img, while the sys- 
tem continuously compares each DDR read between ts 
and te to determine a minimum value, and set DDR^in 
equal to that minimum. After te, DDR increases to Imy. 
However, Imy does not exceed Ime, the last DDR^in, by 
800. Thus, the system continues to read DDR values in 
block 210, and does not calculate damage. At ts, DDR 
has decreased to Ims, and DDR ^1^, = Img. After ts, 
DDR increases and, at tg, DDR exceeds 
DDR^in (Img) + 800 . At this point, the system calcu- 
lates damage based on DDR^ax (1^4) and DDRmin 
(Ims). Thereafter, the system continues to t^o, etc. 

Thus, as can be seen from the foregoing exemplary 
description, based on FIGURES 3 and 4, the system of 
the invention identifies large load reversals and calcu- 
lates damage based on these reversals, rather than on 
intermediate smaller load reversals. 

Returning to FIGURE 2, after local maxima and 
minima have been detected, these are summed to pro- 
vide a running total of the calculated damage. At prede- 
termined intervals, ranging from 10 to 100 seconds or 
more, the rate of change of the summed (or total) calcu- 
lated damage is determined by dividing the change in 
calculated damage during the predetermined period, by 
the period. Importantly, this method allows detection of 
intermittently occurring damage-causing events, that 
might othenwise go unnoticed. By summing the calcu- 
lated damage caused by these intermittent loads, and 
reviewing rate of change of damage over extended 
intervals of time, up to a complete length of a flight, 
small intermittent damage is also monitored. Whereas 
such intermittently occurring damage may be small as 
individual events, the sum may be large and the rate of 
change over a sufficiently long period may be sufficient 
to trigger action. 

Block 120 monitors action based on the rate of 
change of damage. Predetermined critical magnitudes 
are set for rate of change of damage for predetermined 
intervals for which such rates are calculated. If the rate 
of calculated damage exceeds the predetermined mag- 
nitude in the predetermined interval, appropriate action 
is initiated. Thus, if in any time period dtn, the rate of 
change of fatigue damage (fdn/dtn) exceeds a predeter- 
mined critical magnitude (f/t)c, then action an is initiated. 
For example, if the rate of change of fatigue damage is 
high and exceeds (f/t)c in a time period dtn, then ai may 
indicate shutdown of the monitored system. However, if 
the same rate of change of fatigue damage is achieved 
over a longer period of time dt^, then a^ may indicate 
less serious action, such as inspection for damage upon 
landing. 

Before displaying results of the monitoring or taking 
further action, the system executes a precautionary 



subroutine, shown in block 122, that monitors the ena- 
ble logic. This subroutine is a safeguard that prevents 
undesirable activation, and consequent reduced per- 
formance and redundancy of the fight control system, 
when the airplane is operating near the edge of the 
flight envelope, during maintenance activities, or if the 
action of the monitor would result in insufficient fight 
control resources to adequately control the airplane. In 
block 122, the primary flight computer determines 
whether the aircraft is subject to any of these conditions. 
The edge of the flight envelope is programmed into the 
primary flight computer in the form of airplane envelope 
protection control laws. These laws are activated when 
the aircraft approaches the edges of the envelope. For 
example, control laws include overspeed protection, 
stall protection, and bank angle protection. When these 
laws become active, the monitoring system of the inven- 
tion inhibits the calculation of fatigue damage. Control 
laws also inhibit the monitor from taking action during 
the initial takeoff phase of flight, and the final landing 
phase of flight. In the event that a failure occurs during 
these portions of a flight, the monitor will delay action 
until the aircraft has entered a less demanding phase of 
flight. The primary flight computer also determines the 
operational state of the aircraft-whether It is in a main- 
tenance state, where abnormal control system 
responses could occur as a result of maintenance 
actions. The primary flight computer inhibits the calcula- 
tion of fatigue damage during maintenance, thereby 
preventing the possible occurrence of nuisance activa- 
tions. Importantly, as explained before, the primary flight 
computer also assesses available resources in the pri- 
mary flight control system, before the monitoring sys- 
tem is able to take action. If the action that the monitor 
indicates should be taken would result in insufficient 
resources to adequately control the aircraft, then the 
monitor is inhibited from taking action. Additionally, if a 
second failure occurs in a subsystem that would result 
in insufficient resources to adequately control the air- 
craft, the monitor reactivates any system that had previ- 
ously been shut down. In general, therefore, according 
to the invention, a primary flight computer of the aircraft 
overrides the monitoring system failure signal if certain 
situations identified in the control law are present. 

The logic of block 122 is designed to prevent inap- 
propriate shutdown of a subsystem in response to esti- 
mated fatigue damage, falsely indicating a failure of the 
subsystem. If the aircraft is not undergoing mainte- 
nance, and is not in an identified edge of the envelope 
flight pattern, as described above, then the system pro- 
ceeds to block 124, which displays an appropriate sig- 
nal to warn aircraft flight and/or ground crew of potential 
failure in the identified subsystem being monitored. The 
signal may vary depending upon the severity of the esti- 
mated fatigue damage. For instance, as a first option, if 
the fatigue damage estimated is of a very serious 
nature, a signal is also directed to block 126, which 
shuts down the subsystem. In a second option, if the 
estimated damage is not of a very serious nature then 
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the subsystem is not shut down, but the display signal 
indicates to the flight and ground crews that the subsys- 
tem should be inspected for damage. If the fatigue dam- 
age estimated is very low, then the primary flight 
computer may provide an indication that allows contin- 
ued flights for a predetermined period of time, or 
number of flights, before repairs are indicated as neces- 
sary 

While the foregoing description has focused on cer- 
tain embodiments of the invention to aid in providing an 
understanding of the invention, other embodiments are 
clearly useful in a variety of subsystems of a fly-by-wire 
aircraft flight control system. Thus, monitoring need not 
be of actuators, acting in concert, but may be of any 
mechanical or electrical system where at least two units 
operate in concert so that differences in a selected per- 
formance variable may be measured and analyzed, 
substantially as described, to estimate damage or oth- 
enwise indicate failure or malfunction. Based on the esti- 
mated damage, several options for further action may 
be available, depending upon the criticality of the sub- 
system, the flight plan, and a range of other factors, 
each of which can be programmed into the primary 
flight computer to automate resultant action (for exam- 
ple, shut down the subsystem) or indicate action 
needed (display a message). 

Of course, it is contemplated that multiple subsys- 
tems be continuously monitored using the system of the 
invention, as described above. Thus, the invention 
allows comprehensive monitoring of subsystems of a 
fly-by-wire aircraft control system and thereby enhances 
safety and reliability of the aircraft. 

While the preferred embodiment of the invention 
has been illustrated and described, it will be appreciated 
that various changes can be made therein without 
departing from the spirit and scope of the invention. 

Claims 

1 . A method of monitoring subsystems of a fly-by-wire 
primary aircraft flight control system, the method 
comprising: 

(a) communicating signals representing loads 
from each of a first and a second aircraft flight 
control surface controller to an aircraft onboard 
digital signal processor, said controllers nor- 
mally operating in concert; 

(b) periodically determining a difference 
between magnitudes of loads of the first and 
the second controllers; 

(c) comparing a periodically determined differ- 
ence with a difference in load of a prior period; 
and 

(d) calculating fatigue damage resulting from a 
change of load on the controllers. 



2. The method of Claim 1 , wherein the step of com- 
paring periodically determined differences includes 
identifying local maxima and minima. 

5 3. The method of Claim 2, wherein the step of calcu- 
lating Includes calculating loads at local maxima 
and minima. 

4. The method of Claim 3, further comprising display- 
10 ing an instructive signal after calculating fatigue 

damage. 

5. The method of Claim 3, further comprising monitor- 
ing aircraft flight conditions to determine whether 

15 limits of aircraft control laws are exceeded; and 
inhibiting shutdown of the first and second control- 
lers upon exceeding a limit of the laws. 

6. The method of Claim 1 , further comprising compar- 
20 ing monitoring aircraft flight conditions to determine 

whether limits of aircraft control laws are exceeded; 
and inhibiting shutdown of the first and second con- 
trollers upon exceeding a limit of the laws. 

25 7. The method of Claim 1 , further comprising shutting 
down the first and second controllers when calcu- 
lated fatigue damage exceeds a predetermined 
standard. 

30 8. The method of Claim 1 , wherein the first and sec- 
ond controllers comprise a first and a second 
hydraulic actuator, respectively, each of said actua- 
tors mechanically coupled to an aircraft flight con- 
trol surface to orient the flight control surface in 
35 accordance with actuator urging. 

9. A monitoring system for subsystems of a fly-by-wire 
primary aircraft flight control system, the monitoring 
system comprising: 

40 

(a) an aircraft flight control surface; 

(b) a first and a second cooperating controller, 
each in mechanical communication with the 
aircraft flight control surface to urge the flight 

45 control surface into a predetermined orienta- 

tion; and 

(c) a digital signal processor in electrical com- 
munication with a control electronic unit associ- 
ated with each of the first and second 

50 controllers, the computer performing activities 

comprising: 

(i) determining a difference between mag- 
nitudes of loads on the first and second 

55 controller from signals from the electronic 

unit of each of the first and second control- 
lers; 

(ii) periodically comparing the determined 
difference in load magnitude with a prior 
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difference in load magnitude to determine 
localized maxima and minima; and 
(ill) calculating fatigue damage based on 
determined local maxima and minima. 



15 



35 



40 



EP0 743 583 A2 





9 



EP0 743 583 A2 




EP0 743 583 A2 



200 




CALCULATE DAMAGE BASED ON 

DDPmax AND DDPmin 



DDPmax = DDP 



